2025.05.21

Release date: 03-June-2025

Change type	Changes
Added 6 new Low Analytics BIOCs	An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created Conhost.exe spawned a suspicious cmd process Rare process created an SSH session to an uncommon external host Rare process with VNC server capabilities started Uncommon VNC server communication
Added a new Low Analytics Alert	Abnormal RPC traffic to multiple hosts
Added 8 new Informational Analytics BIOCs	A new Azure email domain verification was requested Cloud email sending was enabled Cloud snapshot created or modified Suspicious certificate template modification Uncommon macOS shell command execution Uncommon service stop operation User signed in to an application via Power Automate for the first time Web server CGO executed an uncommon process
Added 3 new Informational Analytics Alerts	Abnormal SMB scanning activity to multiple hosts Cloud email infrastructure enumeration activity Unusual SSH Activity
Improved logic of 2 High Analytics BIOCs	Collection error Mimikatz command-line arguments
Improved logic of 4 Medium Analytics BIOCs	Machine account was added to a domain admins group Phantom DLL Loading Suspicious usage of EC2 token Windows LOLBIN executable connected to a rare external host
Improved logic of 12 Low Analytics BIOCs	AURL - An email was sent from a malicious domain Abnormal communication with a rare combination of TLS and HTTP User Agent EMAIL BETA - Email was received from an unknown sender using a disposable domain EMAIL BETA - External email display name impersonation of internal personnel EMAIL BETA - Unusual hostname for the sending mail server in the email headers EMAIL BETA - Usage of homograph characters detected in an email's from header Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Possible Microsoft process masquerading Potential SCCM credential harvesting using WMI detected Suspicious process accessed certificate files Uncommon remote monitoring and management tool
Improved logic of 33 Informational Analytics BIOCs	A cloud identity executed an API call from an unusual country A user connected from a new country A user created a pfx file for the first time A user was added to a Windows security group AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - Unpopular domain(s) detected in an email's URL(s) Abnormal Communication to a Rare Domain An Azure Key Vault key was modified Azure device code authentication flow used EMAIL BETA - Email Punycode characters in URL EMAIL BETA - Email attachment with multiple extensions EMAIL BETA - Email containing a redirected link EMAIL BETA - Email has a short body or subject and was sent from an external source EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values EMAIL BETA - Email message contains text hiding attributes EMAIL BETA - Email suspicious Moniker link detected EMAIL BETA - Email was received from an unknown sender using a public provider domain EMAIL BETA - Email was received from an unknown sender using a recognized domain EMAIL BETA - Email with URL shortener detected EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email EMAIL BETA - Suspicious Unicode character detected in email EMAIL BETA - Unpopular URL domain(s) in your organization detected in email EMAIL BETA - Unpopular URL(s) detected in email EMAIL BETA - Usage of homograph characters detected in an email First SSO Resource Access in the Organization Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Member added to a Windows local security group Possible DLL Side-Loading Rare signature signed executable executed in the network Uncommon shell command execution User attempted to connect from a suspicious country
Improved logic of 4 Informational Analytics Alerts	A user received multiple weakly encrypted service tickets EMAIL BETA - Suspicious theme and sentiment in email Potential NTLM Relay Attack User added to a group and removed
Decreased the severity to Low for an Analytics Alert	EMAIL BETA - Risk indicators detected in email
Decreased the severity to Informational for 5 Analytics BIOCs	AURL - Email contains URL(s) classified as inappropriate AURL - Email was sent from a domain classified as inappropriate EMAIL BETA - Email containing a link with an IP address convention was detected EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation EMAIL BETA - Unpopular domains detected in email URLs for a recipient
Changed metadata of 2 Medium BIOCs	Manipulation of Firefox plugins and extensions via the Registry WptsExtensions.dll created to disk
Changed metadata of 4 Medium Analytics BIOCs	A machine certificate was issued with a mismatch Discovery of misconfigured certificate templates using LDAP The CA policy EditFlags was queried Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
Changed metadata of 3 Low BIOCs	Chrome runs with key security features disabled DLL sideloading attack using Xwizard Suspicious AMSI DLL load location
Changed metadata of 10 Low Analytics BIOCs	A suspicious process enrolled for a certificate A user modified the CA audit policy Certutil pfx parsing LDAP AD CS Enumeration via Attack Tool Microsoft Office injects code into a process Suspicious Certutil AD CS contact Suspicious access of the System Management Container Unusual CIM repository file access Unusual CertLog Remote File Write User set insecure CA registry setting for global SANs
Changed metadata of a Low Analytics Alert	User added to the SMS Admins local group
Changed metadata of 19 Informational Analytics BIOCs	A LOLBIN was copied to a different location A browser extension was installed or loaded in an uncommon way A suspicious process queried AD CS objects via LDAP A user certificate was issued with a mismatch A user queried AD CS objects via LDAP An app was added to Google Marketplace An identity attached an administrative policy to an IAM user/role Browser Extension Installed Deletion of AD CS certificate database entries EMAIL BETA - Email attachment with a potentially malicious file extension EMAIL BETA - Email attachment(s) with potentially malicious MIME type EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat Key credential attribute modification PKINIT TGT authentication request Possible LDAP Enumeration of Microsoft Configuration Manager PowerShell pfx certificate extraction Privileged certificate request via certificate template Uncommon browser extension loaded Vulnerable certificate template loaded
Changed metadata of 3 Informational Analytics Alerts	A user logged on to multiple workstations via Schannel Abnormal File Activity in SCCMContentLib Shared Folder by user Rare access to known advertising domains
Removed an old Medium Analytics Alert	EMAIL BETA - Potential brand impersonation in email
Removed an old Low Analytics Alert	EMAIL BETA - Potential employee impersonation in email with suspicious theme or sentiment
Removed 4 old Informational Analytics BIOCs	A cloud snapshot was created or modified AURL - An email was received from a domain classified as risky AURL - URL(s) classified as risky have been detected within Email EMAIL BETA - Well-known brand impersonation within an email's from address domain
Removed an old Informational Analytics Alert	EMAIL BETA - Elevated alert triggered by combined alerts and severity
Temporarily removed a Medium Analytics BIOC for improvement	Office process creates a scheduled task via file access